Zombie contracts and shadow IT rarely appear in the data room, but they quietly shape post-close reality. For private equity teams, the risk is not just hidden software spend. It is hidden EBITDA leakage, compliance exposure, and enterprise value left unprotected.
There is a particular kind of silence that follows a deal close. The advisors collect their fees, the legal teams disperse, and the new ownership settles in to execute the value creation thesis. Then, roughly 90 days later, someone pulls the first clean look at operating costs and the questions begin.
Why are we paying for 400 Salesforce seats when fewer than 200 people touch CRM? Who approved a $240,000 annual vendor contract that nobody in IT recognises? Why does actual software spend sit 30 percent above every line item in the model we underwrote?
This is not an edge case. It is one of the most consistent and most expensive post-close surprises in private equity-backed mid-market businesses. It has a name: zombie contracts and shadow IT. And despite how frequently deal teams encounter it, it remains one of the least systematically addressed risks in commercial due diligence today.
Defining the Problem: What Zombie Contracts Actually Cost
A zombie contract is a SaaS agreement that continues to auto-renew, continues drawing down the operating budget, and continues carrying contractual obligations long after any meaningful business activity justifies its existence. The tool is dormant. The invoice is not.
Across mid-market portfolios, SaaSrooms data consistently identifies savings opportunities ranging from 12 to 20 percent of total annual software spend. For a business running $625,000 in annual software commitments, that is between $75,000 and $125,000 in recoverable waste sitting undetected across dozens of line items. Not operational inefficiency. Not suboptimal tooling. Outright financial leakage, billed on auto-renewal cycles that most finance teams are not structured to intercept.
The mechanics behind this are predictable. A department leader champions a platform, negotiates a multi-year deal, and then leaves the company 18 months later. The vendor relationship transfers to nobody in particular. Renewals process automatically. The application sits largely unused, but the obligation does not. Across a mid-market business running dozens of vendor relationships, this pattern repeats across collaboration tools, analytics platforms, project management software, and niche vertical applications. The cumulative cost is rarely visible in any single line item. It is hidden in aggregation.
What makes this particularly difficult to self-diagnose is a structural accountability gap. Portfolio-level stack assessments routinely surface applications with no active user count recorded, no contract expiry date logged, and no assigned budget owner. The spend continues. The oversight does not.
Shadow IT: The Liability That Due Diligence Cannot See
If zombie contracts represent the visible waste, shadow IT represents the invisible liability. And from a risk-adjusted deal structuring perspective, it is the more consequential of the two.
Mid-market companies consistently operate far larger software estates than their official vendor registers reflect. When actual application usage is mapped against what procurement formally tracks, the gap is material across every sector. Tools procured on department credit cards, free trials converted to paid subscriptions, and platforms onboarded without IT approval do not appear in vendor contract schedules. They do not appear in data rooms. But they carry real obligations.
This is shadow IT. And the risk it creates is not theoretical.
Contractual exposure without contractual visibility. Every time a department head signs up for an AI-assisted workflow tool or a third-party data platform using a corporate card, the company has entered a binding legal agreement. The terms governing data processing, liability, auto-renewal, and termination rights have never been reviewed by legal counsel, never negotiated, and will not appear in any vendor contract schedule prepared for a data room, because nobody in finance or legal knows the agreement exists.
Data security and regulatory compliance gaps. Shadow IT applications routinely access company data, customer records, and in regulated industries, protected personal information. When a marketing team uploads customer lists to an unsanctioned AI tool, or a finance analyst exports a revenue model into an unapproved analytics platform, sensitive data has left the organisation’s governed environment. Post-close, this becomes the acquirer’s compliance liability. The exposure pre-existed the deal. The obligation transfers with the business.
Post-close EBITDA compression that the model did not anticipate. When a new owner rationalises the true software estate after close, two dynamics collide. Zombie contracts are cancelled, generating savings on paper. But shadow IT applications that operational teams genuinely depend on must be replaced or formally legitimised, carrying both direct replacement cost and productivity disruption. The net EBITDA effect is rarely the clean recovery the value creation plan assumed.
The licence mismatch problem compounds this further. A pattern seen repeatedly across portfolio assessments: a core productivity platform showing significantly more assigned users than purchased licences, with auto-renewal active and no flag raised in the preceding renewal cycle. In one case, a single vendor contract carried 175 purchased licences against 275 users in the system, auto-renewing annually at $96,000, with the overage running unnoticed across multiple finance cycles. Contracts of this type are not uncommon. They are the rule in businesses that have not implemented systematic software governance.
Why Traditional Due Diligence Consistently Misses This
The data room contains what management chooses to surface. Vendor contract schedules reflect what the finance team knows about. Software spend in the P&L sits aggregated under broad cost categories that obscure individual application costs and make vendor-level analysis structurally difficult.
A deal team reviewing 200 line items in a technology cost schedule has no reliable mechanism to determine whether those 200 lines represent the full software estate or 55 percent of it. Technology workstreams in commercial due diligence typically focus on architecture, scalability, and key system risk. SaaS sprawl, licence governance, and contract renewal exposure rarely receive the same rigour, despite their direct effect on the EBITDA bridge.
The result is a category of risk that is large enough to be material, specific enough to be measurable, and consistently invisible until after the deal closes.
The CFO Calculation: Enterprise Value at Stake
For CFOs evaluating an acquisition target or managing SaaS governance across a portfolio, the reframe is straightforward. Zombie contracts and shadow IT are not IT management failures. They are contingent liabilities with a computable effect on enterprise value.
The numbers bear this out. Across active SaaSrooms portfolio engagements, a business running approximately $970,000 in annual software spend typically carries 20 or more identified optimisation opportunities, with total savings potential in the range of $138,000. That figure spans licence right-sizing, contract term renegotiation, supplier switching, and outright elimination of dormant tools. It is not a theoretical ceiling. It is a documented baseline.
At a deal multiple of 8x to 12x, $138,000 in recoverable annual waste translates to between $1.1 million and $1.6 million in enterprise value, either overpaid or left on the table, before any compliance or contractual liability exposure is priced in.
This is the calculation deal partners who have experienced post-close surprises know instinctively. The surprise is never one large contract. It is the accumulation of 60 or 80 small, unscrutinised commitments that nobody systematically mapped before signing.
Building the Capability Before It Becomes the Problem
The practical path forward exists at two points in the deal lifecycle.
Pre-close, technology spend and utilisation assessment should be a standard workstream in commercial due diligence for any software-intensive business. The scope goes beyond the vendor contract schedule: it maps actual application usage against licensed seats, identifies contracts with no assigned budget owner or expiry date, and flags renewal dates falling within the first 12 months post-close. Deal teams that have embedded this workstream report fewer post-close surprises and, in a meaningful number of cases, have used the findings to support price adjustments or specific indemnity provisions in the purchase agreement.
Post-close, the first 90 to 100 days should include a structured SaaS rationalisation process. This is not a cost reduction programme in the traditional sense. It is a governance exercise whose output includes a single source of truth for all software commitments, defined ownership for every active vendor relationship, and a renewal management process designed to prevent zombie contracts from regenerating as the business evolves. Completed optimisation cycles across SaaSrooms-managed engagements have delivered confirmed savings ranging from $24,000 to $50,000 per cycle, with larger rationalisation pipelines continuing beyond initial close.
The capability to map an application estate, score optimisation opportunities, surface renewal risk, and benchmark spend across a portfolio is now a deployable operational discipline. The question is whether it is deployed before or after the surprise.
The Governance Imperative
Shadow IT and zombie contracts are symptoms of a predictable governance gap. They emerge when software procurement is decentralised without adequate controls, when renewal management is reactive rather than systematic, and when individual SaaS subscriptions feel small enough that department managers treat them as discretionary spend rather than balance sheet commitments.
At scale, those individual decisions aggregate into a liability profile that affects deal value, post-close operating performance, and in some cases, regulatory standing.
The organisations addressing this systematically are not doing so because they prefer operational complexity. They are doing so because they have run the numbers, absorbed a post-close surprise or two, and concluded that the cost of building the governance capability is reliably lower than the cost of discovering it was missing.
For CFOs and deal partners, the question is no longer whether this risk exists in the businesses you are evaluating. The data is consistent and the pattern is well-documented. The question is whether your diligence process is equipped to see it before the deal closes, or whether you will be the one pulling a cost report 90 days later asking why the numbers do not match.
